> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios/offline-scenario.md).

# Offline Scenario

***

### Overview

There are situations where network access isn't always guaranteed - whether you're traveling, working in a low-connectivity area, or on a flight. The 1Kosmos Windows Workstation MFA agent ensures you can still securely access your workstation even when there is no internet connection or the 1Kosmos cloud is temporarily unavailable.

When the Credential Provider detects an offline state, it automatically switches to supported offline authentication methods. Online methods such as Push Notification, QR Code, SMS/Email/Voice OTP, and online FIDO are not available without connectivity. The following offline methods are supported:

* PIN
* OTP

For the best offline authentication experience, it is recommended to complete at least one passwordless online login beforehand. However, this is not mandatory, if passwordless login was never configured, the offline login will prompt the user to enter their password and OTP.

The Windows Workstation MFA agent supports offline login for both domain and local users. To enable offline logins, the community seed must be configured in the registry of the target workstation. When the system is offline, the Windows Workstation MFA agent shows an offline indicator on the UI. If the community seed is unavailable, the agent notifies users that offline login is not enabled when they attempt to log in. However, 1Kosmos still allows users to log in with local accounts in such cases.

By adopting this feature, users can enjoy seamless access during offline scenarios using the Account OTP from the 1Kosmos mobile app. If passwordless login has not been completed beforehand, the password will serve as an additional factor for offline authentication.

Starting with Release v2.0.8.0, multi-factor authentication (MFA) methods are displayed for both local and remote account logins. To enable MFA for a local user, the local account must be added as an alias.

Administrators can configure the authentication journey for primary users via the AdminX interface. While in AdminX interface, they must add local user as an alias for primary user. If no custom journey is set for the primary user, the Windows Workstation MFA Agent will display the default five options: password, OTP, QR, FIDO and Push. Users can select any of these methods to log in to the workstation.

The local users still need to enter their password.

**Offline Login Behavior (Local Users):**

* If Offline Login is enabled (i.e., the community seed is configured):
  * The local user associated with an alias is prompted to enter the Account OTP of the primary user along with their password to log in.
* If Offline Login is not enabled (i.e., the community seed is not configured):
  * The local user can log in using only their password, without needing to provide the Account OTP.

#### Enabling Offline Login Mechanism <a href="#enabling-offline-login-mechanism" id="enabling-offline-login-mechanism"></a>

To enable offline login support, the administrator must add the OTP Seed to the system registry of the Windows Workstation MFA agent. To associate the OTP Seed with the registry, follow these steps:

1. Navigate to the Adminx interface.
2. Go to **Authentication > Multi-Factor Authentication > Account OTP for Offline Authentication** section and copy the OTP seed.
3. Navigate to the following registry path:

```
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{90576E81-DDF8-4E8E-91E2-CA3A9CE52410} 
```

4. Create a registry key in the following format:

```
CommunitySeed_$dns_$communityName
```

5. In dns and communityName, replace any occurrence of “.” with “\_” so that the updated Registry Key name appears as follows:
6. Add the following registry keys.

| Registry Key                                       | Registry Type |
| -------------------------------------------------- | ------------- |
| CommunitySeed\_acme\_1Kosmos\_net\_default         | REG\_SZ       |
| CommunitySeed\_acme-dev\_1Kosmos\_net\_development | REG\_SZ       |

The registry can be updated either through the SCCM / GPO update by the organization or via the BlockIDInstaller.bat script using the `-configure` directive. Administrators must update the `REGCONFIG` file to add the CommunitySeed and value.

#### Sign in using Offline Login <a href="#sign-in-using-offline-login" id="sign-in-using-offline-login"></a>

To access your workstation during offline, follow these steps:

1. In the login screen, click the **Other User** tile and select the **BlockID** option.
2. When the Sign In page displays the No Internet icon, enter your username and click Submit.
3. The available offline authentication methods are displayed based on your configuration:

   * OTP is available if Community Seed is configured.
   * PIN is available if Behavioral Authentication and PIN are configured, the user has completed PIN enrollment, and has successfully authenticated online at least once so that the PIN is cached.
   * If both configurations are available, both OTP and PIN options will be displayed.

   4\. Select the desired authentication method:

   * Enter the Account OTP generated by the 1Kosmos mobile app, or
   * Enter your offline PIN.

   5\. Upon successful authentication, you will be logged in to the workstation.

   **Note:** The cached offline PIN is invalidated after three consecutive incorrect attempts. Once the retry limit is reached, the user must authenticate online again to re-establish the cache

### Troubleshooting

| Issue                             | Likely Cause                                                                                                     | Resolution                                                                                                                    |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| PIN option not shown when offline | Behavior Auth & PIN not configured; user never completed online enrollment or has not authenticated online once. | Verify the journey uses Behavior Auth & PIN; reconnect to the network and complete enrollment before the next offline session |
| Cached PIN cleared unexpectedly   | 3 failed PIN attempts were made in a previous offline session                                                    | Reconnect the device to the network; complete an online login to re-establish the cached PIN                                  |

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/deployment-scenarios/offline-scenario.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.